Okta session IP hop
One Okta account evaluated from two different addresses within minutes.
What it detects
One Okta account evaluated from two different addresses within minutes.
A stolen session cookie does not need a password, does not trip MFA, and does not create a sign-in the user would recognise — it simply replays. What it cannot hide is where it replays FROM. The legitimate holder stays put; the thief is somewhere else, and for a while both are using the same identity.
Keyed on distinct source addresses per account inside a short window on sign-on evaluation events, which is when Okta records the address a session is being exercised from. The corpus capture behind this shows the same account evaluated from a US address and a German one sixty seconds apart, which no single person did.
Without geolocation the product cannot compute travel velocity offline, so this deliberately does not claim to be impossible-travel. It is the weaker, honest version: two places at once, near enough in time that one of them is not the user.
MITRE ATT&CK mapping
False positives and triage
This is the noisiest rule in the Okta set and it is meant to be read with its evidence open, never triaged on the title. Mobile clients change address constantly — wifi to cellular, one cell to the next, a corporate VPN connecting or dropping — and each produces exactly this pattern.
What separates theft is whether the two addresses are plausibly the same person. Compare their networks: two addresses in one carrier's range are a handover, one corporate address plus one hosting-provider or VPN-exit address are not. Compare the CLIENTS: a session evaluated from an iOS Okta Verify agent and from a desktop browser at once is two devices, and only one of them may be the user's. A tenant with heavy mobile use should allowlist its known egress ranges rather than raise the count — raising it to three would simply mean the thief has to wait, and the rule would catch nothing.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/okta_session_ip_hop.yaml, licensed under the Apache License 2.0.
id: cloud.identity.okta_session_ip_hop
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1539, T1550.004]
description: |
One Okta account evaluated from two different addresses within minutes.
A stolen session cookie does not need a password, does not trip MFA, and does
not create a sign-in the user would recognise — it simply replays. What it
cannot hide is where it replays FROM. The legitimate holder stays put; the thief
is somewhere else, and for a while both are using the same identity.
Keyed on distinct source addresses per account inside a short window on
sign-on evaluation events, which is when Okta records the address a session is
being exercised from. The corpus capture behind this shows the same account
evaluated from a US address and a German one sixty seconds apart, which no
single person did.
Without geolocation the product cannot compute travel velocity offline, so this
deliberately does not claim to be impossible-travel. It is the weaker, honest
version: two places at once, near enough in time that one of them is not the
user.
match:
provider: Okta
event_action_contains_any:
- policy.evaluate_sign_on
- user.session.start
- user.authentication.sso
threshold:
distinct: source_ip
# Two addresses in five minutes. A phone handing off between wifi and cellular
# does exactly this, which is why the guidance leads on how to tell them apart
# rather than the count doing it.
count: 2
window_seconds: 300
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
This is the noisiest rule in the Okta set and it is meant to be read with its
evidence open, never triaged on the title. Mobile clients change address
constantly — wifi to cellular, one cell to the next, a corporate VPN connecting
or dropping — and each produces exactly this pattern.
What separates theft is whether the two addresses are plausibly the same person.
Compare their networks: two addresses in one carrier's range are a handover, one
corporate address plus one hosting-provider or VPN-exit address are not. Compare
the CLIENTS: a session evaluated from an iOS Okta Verify agent and from a
desktop browser at once is two devices, and only one of them may be the user's.
A tenant with heavy mobile use should allowlist its known egress ranges rather
than raise the count — raising it to three would simply mean the thief has to
wait, and the rule would catch nothing.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.